Cisco Systems 78-11741-02 manual Turbo Access Control List Example, IPC-123

Configuring IP Services

IP Services Configuration Examples

Turbo Access Control List Example

The following is a Turbo ACL configuration example. The access-list compiled global configuration command output indicates that Turbo ACL is enabled.

interface Ethernet2/7 no ip address

ip access-group 20 out no ip directed-broadcast shutdown

!
no ip classless
ip route 192.168.0.0		255.255.255.0 10.1.1.1
!
access-list compiled
access-list 1 deny		any
access-list 2	deny	192.168.0.0 0.0.0.255
access-list 2	permit	any

Implicit Masks in Access Lists Examples

IP access lists contain implicit masks. For instance, if you omit the mask from an associated IP host address access list specification, 0.0.0.0 is assumed to be the mask. Consider the following example configuration:

access-list 1 permit 0.0.0.0 access-list 1 permit 131.108.0.0 access-list 1 deny 0.0.0.0 255.255.255.255

For this example, the following masks are implied in the first two lines:

access-list 1 permit 0.0.0.0 0.0.0.0 access-list 1 permit 131.108.0.0 0.0.0.0

The last line in the configuration (using the deny keyword) can be left off, because IP access lists implicitly deny all other access. Leaving off the last line in the configuration is equivalent to finishing the access list with the following command statement:

access-list 1 deny 0.0.0.0 255.255.255.255

The following access list only allows access for those hosts on the three specified networks. It assumes that subnetting is not used; the masks apply to the host portions of the network addresses. Any hosts with a source address that does not match the access list statements will be rejected.

access-list 1 permit 192.5.34.0 0.0.0.255 access-list 1 permit 128.88.0.0 0.0.255.255 access-list 1 permit 36.0.0.0 0.255.255.255 ! (Note: all other access implicitly denied)

To specify a large number of individual addresses more easily, you can omit the address mask that is all 0s from the access-listglobal configuration command. Thus, the following two configuration commands are identical in effect:

access-list 2 permit 36.48.0.3 access-list 2 permit 36.48.0.3 0.0.0.0

Cisco IOS IP Configuration Guide

IPC-123